LoFP LoFP / file types that are not included in the filter for this detection may generate false positives, so proper filtering is required.

Techniques

Sample rules

Windows Executable Masquerading as Benign File Types

Description

The following analytic detects the presence of executable files masquerading as benign file types on Windows systems. Adversaries employ this technique to evade defenses and trick users into executing malicious code by renaming executables with extensions commonly associated with documents, images, or other non-executable formats (e.g., .pdf, .jpg, .doc, .png).

Detection logic

`sysmon`
EventCode=29
NOT `executable_extensions`

| stats count min(_time) as firstTime max(_time) as lastTime
  by Image file_name file_path process_guid file_hash process_id dest user EventCode

| `security_content_ctime(firstTime)`

| `security_content_ctime(lastTime)`

| `windows_executable_masquerading_as_benign_file_types_filter`